From 84a6c6017d05eec91b88e7894263d398d91e265f Mon Sep 17 00:00:00 2001
From: Lasse Brandt <lasse@bitmand.com>
Date: Tue, 14 Nov 2017 12:55:52 +0100
Subject: [PATCH] Build a custom dhparam file once for nginx and include it as
 default

---
 plugins/nginx-vhosts/install | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/plugins/nginx-vhosts/install b/plugins/nginx-vhosts/install
index 39b0d5cc6..578fc6762 100755
--- a/plugins/nginx-vhosts/install
+++ b/plugins/nginx-vhosts/install
@@ -26,6 +26,12 @@ esac
 
 chmod 0440 /etc/sudoers.d/dokku-nginx
 
+# if dhparam.pem has not been created, create it the first time
+if [[ ! -f /etc/nginx/dhparam.pem ]]; then
+  openssl dhparam -out /etc/nginx/dhparam.pem 2048
+  chown root:root /etc/nginx/dhparam.pem
+fi
+
 # if dokku.conf has not been created, create it
 if [[ ! -f /etc/nginx/conf.d/dokku.conf ]]; then
   mkdir -p /etc/nginx/conf.d
@@ -40,6 +46,7 @@ ssl_session_cache shared:SSL:20m;
 ssl_session_timeout 1d;
 ssl_session_tickets on;
 
+ssl_dhparam /etc/nginx/dhparam.pem;
 ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS;
 
 EOF